CVE-2007-5200 insecure tmp file handling

Debian Bug report logs - #447344
CVE-2007-5200 insecure tmp file handling

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: submit@bugs.debian.org

Subject: CVE-2007-5200 insecure tmp file handling

Date: Sat, 20 Oct 2007 12:14:25 +0200

[Message part 1 (text/plain, inline)]

Package: hugin
Version: 0.6.1-1
Severity: important
Tags: security patch

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for hugin.

CVE-2007-5200[0]:
| hugin in SUSE openSUSE 10.2 and 10.3 allows local users to overwrite
| arbitrary files via a symlink attack on a temporary file.

If you fix this vulnerability please also include the CVE id
in your changelog entry.

What SuSE did is just to delete the debug output to the tmp 
file:

--- src/Panorama/PTOptimise.cpp
+++ src/Panorama/PTOptimise.cpp
@@ -36,9 +36,6 @@
 #include <boost/property_map.hpp>
 #include <boost/graph/graph_utility.hpp>
 
-#define DEBUG_WRITE_OPTIM_OUTPUT
-#define DEBUG_WRITE_OPTIM_OUTPUT_FILE "hugin_debug_optim_results.txt"
-
 using namespace std;
 using namespace PT;
 using namespace PTools;
@@ -132,13 +129,6 @@
                        RunLMOptimizer( &opt );
                        ainf.data               = opt.message;
             // get results from align info.
-#ifdef DEBUG_WRITE_OPTIM_OUTPUT
-            fullPath path;
-            StringtoFullPath(&path, DEBUG_WRITE_OPTIM_OUTPUT_FILE );
-
-                   ainf.data           = opt.message;
-            WriteResults( script, &path, &ainf, distSquared, 0);
-#endif
             pano.updateVariables(GetAlignInfoVariables(ainf) );
             pano.updateCtrlPointErrors( GetAlignInfoCtrlPoints(ainf) );
                }


For further information:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5200

Kind regards
Nico

-- 
Nico Golde - http://ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #10 received at 447344@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 447344@bugs.debian.org

Subject: Re: CVE-2007-5200 insecure tmp file handling

Date: Wed, 24 Oct 2007 18:39:30 +0200

[Message part 1 (text/plain, inline)]

Hi,
I intent do NMU this package to fix the vulnerability.
Attached is a patch for an NMU.
It will be also archived on:
http://people.debian.org/~nion/nmu-diff/hugin-0.6.1-1_0.6.1-1.1.patch
Kind regards
Nico

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[hugin-0.6.1-1_0.6.1-1.1.patch (text/x-diff, attachment)]

[Message part 3 (application/pgp-signature, inline)]

Message #15 received at 447344@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 447344@bugs.debian.org

Subject: Re: CVE-2007-5200 insecure tmp file handling

Date: Thu, 25 Oct 2007 11:51:27 +0200

[Message part 1 (text/plain, inline)]

Hi,
uploading an NMU now with permission of the maintainer.
Kind regards
Nico

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #20 received at 447344@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: control@bugs.debian.org

Cc: 447344@bugs.debian.org

Subject: fixed 447344 in 0.6.1-1.1

Date: Fri, 26 Oct 2007 19:57:46 +0200

# Automatically generated email from bts, devscripts version 2.10.9
# due to a typo in changelog this was not closed but it is fixed in 0.6.1-1.1
fixed 447344 0.6.1-1.1

Message #27 received at 447344-done@bugs.debian.org (full text, mbox, reply):

From: "Adam Buchbinder" <adam.buchbinder@gmail.com>

To: 447344-done@bugs.debian.org

Subject: Closing.

Date: Fri, 14 Mar 2008 09:56:47 -0400

Per Nico Golde's comment, this bug should have been closed when the
fixed version was released. Explicitly closing now.

Adam Buchbinder

Send a report that this bug log contains spam.